Yes, that kmsg is normal.
The key difference is here:
6>[ 0.401113] Trying to unpack rootfs image as initramfs...
<6>[ 0.403729] rootfs image is not initramfs (no cpio magic); looks like an initrd
<6>[ 0.438490] Freeing initrd memory: 4096K
where this camera is happy to use the initrd that's in mtdblock11 and does not require that it be initramfs and baulk when it isn't.
As you've already dropped the known working initrd mtdblock11 in your bricked camera and it made no difference, something else is making the firmware require an initramfs instead of the initrd for the ramdisk load.
As you seem quite comfortable with all this low-level messing about, here is something you could consider.
Tedious though it may be to do - it might be useful to grab a copy of mtdblock5 & 6 from the failing camera, and use HxD to do a comparison with the same file off your good camera.
There should be space in /dav to do a 'cat /dev/mtdblock5 > block5' then '
tftp -p -l block5 <IP address of the PC running the TFTP server>' and the same for mtdblock6. Maybe use 'rm block5' to free space before that.
If you do the comparison, mtdblock6 will be the easiest to start with.
In the hardware descriptor block there will be differences for the Checksum-16 checksum (0x04-05), MAC address (0x35-4A), the manufacturing date (0x31-51). *edit* 0x
41-51
Any other differences might provide a clue - perhaps at 0x56
And I suppose there could be large differences elsewhere - but I'm not sure what that could mean.
I have not tried this myself as I don't have one of these new-manufacture cameras, but @
whoslooking has confirmed that a change such as incrementing the language byte and decrementing something not significant elsewhere such as manufacturing date does not brick the camera when the checksum is unchanged. So there may be potential to replace mtdblock5 & 6 from the working camera with a change to the MAC address so networking isn't broken.
Or if there is just a single difference, modify the copies you took from the failing camera using the whoislooking method. Remember there are 4 in total copies of the hardware descriptor block.
All speculative, of course, as unfortunately I don't have a suitable camera to test this on.